I am trying to use AWS KMS to encrypt in asp.net core it's work fine on local system. But when we deploy on elastic beanstalk they give an exception

Question

public async Task<string> EncryptText(string textToEncrypt, string keyID)
{
    if (string.IsNullOrWhiteSpace(textToEncrypt))
    {
        return "";
    }
    else
    {
        var result = "";
        var client = new AmazonKeyManagementServiceClient();
        var encryptRequest = new Amazon.KeyManagementService.Model.EncryptRequest();
        encryptRequest.KeyId = keyID;
        var textBytes = Encoding.UTF8.GetBytes(textToEncrypt);
        encryptRequest.Plaintext = new MemoryStream(textBytes, 0, textBytes.Length);
        var response = await client.EncryptAsync(encryptRequest);

        if (response != null)
        {
            result = Convert.ToBase64String(response.CiphertextBlob.ToArray());
        }
        return result;
    }
}

This following code perfectly work on local system but get an elastic beanstalk. I cannot find out why this error come

Answer 1

What is the error you are getting? It is most likely an IAM issue. The IAM user permissions on your local box are not the same as the instance profile on the EC2 instance.

1. Navigate to Elastic Beanstalk > Environments > Your environment > Configuration

2. Under Security find the IAM instance profile that is being used.

3. Go to IAM and find the role. It should have a policy statement that allows encrypt actions using that key. Something like:

        {
            "Action": [
                "kms:Decrypt",
                "kms:Encrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*"
            ],
            "Resource": "arn:aws:kms:{my region}:{my account id}:key/{my key id}",
            "Effect": "Allow"
        }

4. Also go to KMS to check the Key Policy. It might look something like:

        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "{my iam instance profile arn}"
            },
            "Action": [
                "kms:Decrypt",
                "kms:Encrypt",
                "kms:ReEncrypt*",
                "kms:GenerateDataKey*"
            ],
            "Resource": "*"
        }

We need more details about the error to properly assess the problem. But maybe this is the issue.